GHSA-C8M5-C952-6CM4 vulnerabilities

Vulnerabilities for packages: cloud-hypervisor, symbolicator, zizmor, kcl-lib, kdash, wadm, cleave, zellij, ascan, ntpd-rs, cargo-audit, symbolicator-fips, komodo, qdrant, sccache, lychee, samply, sentry-relay-fips, vector, sentry-relay, buck2, garage, efs-utils, graphql-hive-router-query-planner...

GHSA-W44R-93J7-QV28 vulnerabilities

Vulnerabilities for packages: cloud-hypervisor, symbolicator, zizmor, kcl-lib, kdash, wadm, cleave, zellij, ascan, ntpd-rs, cargo-audit, symbolicator-fips, komodo, qdrant, sccache, lychee, samply, sentry-relay-fips, vector, sentry-relay, buck2, garage, efs-utils, graphql-hive-router-query-planner...

GHSA-VP88-798V-H67F vulnerabilities

Vulnerabilities for packages: cloud-hypervisor, symbolicator, zizmor, kcl-lib, kdash, wadm, cleave, zellij, ascan, ntpd-rs, cargo-audit, symbolicator-fips, qdrant, sccache, lychee, samply, sentry-relay-fips, sentry-relay, buck2, efs-utils, graphql-hive-router-query-planner, wasmcloud...

GHSA-H2V8-394M-P7VV vulnerabilities

Vulnerabilities for packages: cloud-hypervisor, symbolicator, zizmor, kcl-lib, kdash, wadm, cleave, zellij, ascan, ntpd-rs, cargo-audit, symbolicator-fips, komodo, qdrant, sccache, lychee, samply, sentry-relay-fips, vector, sentry-relay, buck2, garage, efs-utils, graphql-hive-router-query-planner...

GHSA-C8M5-C952-6CM4 vulnerabilities

Vulnerabilities for packages: cleave, lychee, ntpd-rs, sccache, ascan, samply, qdrant, vector, buck2, zellij, wasmcloud, cargo-audit, efs-utils, kdash, zizmor, wadm...

GHSA-H2V8-394M-P7VV vulnerabilities

Vulnerabilities for packages: cleave, lychee, ntpd-rs, sccache, ascan, samply, qdrant, vector, buck2, zellij, wasmcloud, cargo-audit, efs-utils, kdash, zizmor, wadm...

GHSA-VP88-798V-H67F vulnerabilities

Vulnerabilities for packages: cleave, lychee, ntpd-rs, sccache, ascan, samply, qdrant, buck2, zellij, wasmcloud, cargo-audit, efs-utils, kdash, zizmor, wadm...

GHSA-W44R-93J7-QV28 vulnerabilities

Vulnerabilities for packages: cleave, lychee, ntpd-rs, sccache, ascan, samply, qdrant, vector, buck2, zellij, wasmcloud, cargo-audit, efs-utils, kdash, zizmor, wadm...

CVE-2026-77470

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-77468

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerate...

CVE-2026-77466

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-77467

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...

CVE-2026-61610

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61611

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...

CVE-2026-61838

Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...

CVE-2026-62679

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-57569

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-57568

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-77466 Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-77466

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...